External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: gate SUDO_USER trust and root path diversion; add doctor binary check

Browse Source 
Address review findings on the system-install PR:

- cloud_sink: honor SUDO_USER for audit attribution only when euid==0.
  Without the gate any user could set SUDO_USER and spoof cloud-audit
  attribution to another account. Matches the guard in cmd/setup/cert.go.

- config: divert per-user paths to root's passwd home only on an actual
  sudo elevation (euid==0 && SUDO_USER set), not for every root euid.
  The blanket root diversion ignored HOME/XDG_CONFIG_HOME and silently
  stopped reading genuine root users' config (golden Docker images),
  regressing two tests that only fail when the suite runs as root.
  Genuine root honors the environment as before; su without - leaves no
  marker and stays a documented, loud-failing residual.

- doctor: add a system-only check re-validating that the binary the
  installed shims exec is still root-owned and non-writable, catching
  permission/ownership drift after install.

- shim: fold the duplicated shim-scan loop into firstShimContent.
This commit is contained in:
Sahilb315
2026-07-14 13:07:27 +05:30
parent 297f516242
commit 4b2a25a378
9 changed files with 211 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/rootdir_test.go
+29 -3
View File
@@ -25,9 +25,10 @@ func poisonUserEnv(t *testing.T) {
t.Setenv("XDG_CACHE_HOME", "/home/victim/.cache")
}
func TestConfigDirAsRootIgnoresPreservedHome(t *testing.T) {
func TestConfigDirUnderSudoIgnoresPreservedHome(t *testing.T) {
poisonUserEnv(t)
withEuid(t, 0)
t.Setenv("SUDO_USER", "victim")
dir, err := configDir()
require.NoError(t, err)
@@ -38,6 +39,18 @@ func TestConfigDirAsRootIgnoresPreservedHome(t *testing.T) {
assert.NotContains(t, dir, "/home/victim")
}
func TestConfigDirGenuineRootHonorsEnv(t *testing.T) {
// Root without sudo (SUDO_USER unset) is the intended user, e.g. a golden
// Docker image that deliberately sets XDG_CONFIG_HOME. It must not divert.
poisonUserEnv(t)
withEuid(t, 0)
t.Setenv("SUDO_USER", "")
dir, err := configDir()
require.NoError(t, err)
assert.Contains(t, dir, "/home/victim")
}
func TestConfigDirAsNonRootUsesEnvHome(t *testing.T) {
poisonUserEnv(t)
withEuid(t, 1000)
@@ -47,19 +60,21 @@ func TestConfigDirAsNonRootUsesEnvHome(t *testing.T) {
assert.Contains(t, dir, "/home/victim")
}
func TestConfigDirEnvOverrideWinsForRoot(t *testing.T) {
func TestConfigDirEnvOverrideWinsUnderSudo(t *testing.T) {
poisonUserEnv(t)
t.Setenv("PMG_CONFIG_DIR", "/custom/pmg")
withEuid(t, 0)
t.Setenv("SUDO_USER", "victim")
dir, err := configDir()
require.NoError(t, err)
assert.Equal(t, "/custom/pmg", dir)
}
func TestCacheDirAsRootIgnoresPreservedHome(t *testing.T) {
func TestCacheDirUnderSudoIgnoresPreservedHome(t *testing.T) {
poisonUserEnv(t)
withEuid(t, 0)
t.Setenv("SUDO_USER", "victim")
dir, err := cacheDir()
require.NoError(t, err)
@@ -70,6 +85,16 @@ func TestCacheDirAsRootIgnoresPreservedHome(t *testing.T) {
assert.NotContains(t, dir, "/home/victim")
}
func TestCacheDirGenuineRootHonorsEnv(t *testing.T) {
poisonUserEnv(t)
withEuid(t, 0)
t.Setenv("SUDO_USER", "")
dir, err := cacheDir()
require.NoError(t, err)
assert.Contains(t, dir, "/home/victim")
}
func TestCacheDirAsNonRootUsesEnvHome(t *testing.T) {
poisonUserEnv(t)
withEuid(t, 1000)
@@ -82,6 +107,7 @@ func TestCacheDirAsNonRootUsesEnvHome(t *testing.T) {
func TestRootDirsFallBackToEnvWhenPasswdUnavailable(t *testing.T) {
poisonUserEnv(t)
withEuid(t, 0)
t.Setenv("SUDO_USER", "victim")
origConfig, origCache := rootConfigDirResolver, rootCacheDirResolver
rootConfigDirResolver = func() (string, error) { return "", assert.AnError }